Keppel T&T fined $120,000 over data breach affecting thousands

Academy of Medicine S’pore fined 9k in separate case after lapses led to data leak

- Ang Qing

Keppel Telecommunications & Transportation (KTT) has been fined $120,000 after it failed to delete personal data from a server of a business it sold in 2022, which was then hacked.

The Personal Data Protection Commission (PDPC) said in a decision, published online on Aug 2, that the personal data, which belonged to about 22,659 people, was at risk of being accessed without permission and being leaked.

The affected people included employees and former employees of KTT and its subsidiaries, KTT's shareholders when it was listed on the Singapore Exchange, and those who had business or commercial dealings with the company.

Evidence of the data leak emerged when a ransomware group published nine encrypted files on the Dark Web, along with what it claimed to be a list detailing the encrypted files' contents. This was linked to up to 7,184 individuals' personal data stored in the affected server.

However, KTT was unable to confirm whether the encrypted files contained all the personal data stored in the affected server, the PDPC noted.

The signatures, images of identification cards and bank account numbers of some people were in the leaked data.

The PDPC said this exposed certain people to greater risks of identity theft or financial losses.